Snipe-IT 8.8.3

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Snipe-IT 8.8.3 on Ubuntu 24.04 as the software version, pick your Region, then choose Launch through EC2.

Choose m5.large, or a larger type for many users or a large register. Choose your key pair and a security group as described above.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=snipe-it}]'

First boot builds the database. It takes about two minutes after the instance is running.

Version SSH user

Snipe-IT 8.8.3 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot creates the database, the settings file, the administrator and the API keys, and it generates the certificate. nginx, PHP and the scheduler start only after first boot has finished. snipeit-egress-guard loads the outbound rules for the snipeit user at every boot:

systemctl is-active nginx php8.3-fpm mariadb snipeit-scheduler snipeit-egress-guard snipeit-firstboot
sudo test -f /var/lib/sac/data/snipeit-firstboot.done && echo FIRSTBOOT_DONE

All six units are active, and the first-boot marker is present:

active active active active active active FIRSTBOOT_DONE

Only SSH and nginx listen on network ports. MariaDB has no network listener at all, and PHP-FPM uses a local socket:

sudo ss -lntp | awk 'NR>1 && $4 !~ /^127\.0\.0\.5[34]/ {split($6, p, "\""); print $4, p[2]}' | sort

0.0.0.0:22 sshd 0.0.0.0:443 nginx 0.0.0.0:80 nginx [::]:22 sshd [::]:443 nginx [::]:80 nginx

sudo cat /root/snipeit-credentials.txt

Only root can read the file:

# Snipe-IT 8.8.3 - generated on first boot by snipeit-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret. SNIPEIT_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ SNIPEIT_ADMIN_USERNAME=admin SNIPEIT_ADMIN_EMAIL=admin@example.com SNIPEIT_ADMIN_PASSWORD=<SNIPEIT_ADMIN_PASSWORD>
#
# Open SNIPEIT_URL in a browser (self-signed certificate minted on this instance's first boot; port 80 redirects to # https) and sign in with the username and password above. Setup is already complete: set your own e-mail address in # Admin > Settings > General and on your profile, then configure mail (the guide shows how). # MariaDB: unix socket only (no TCP listener, no database password: Snipe-IT runs as the OS user snipeit); # sudo mysql snipeit (root signs in over the socket) # Settings: /etc/snipe-it/snipeit.env (owned by snipeit; then:
sudo snipeit-artisan optimize:clear)
# Artisan:
sudo snipeit-artisan <command> Scheduler: systemctl status snipeit-scheduler
# Change the password:
sudo snipeit-set-password
# Change the name it serves as:
sudo snipeit-set-hostname <your-dns-name>
# Hosts in this VPC Snipe-IT may reach (LDAP, SMTP): /etc/sac/snipeit-egress-allow.conf
# User guide: https://secureanycloud.com/stacks/snipe-it-8-8-3/

The URL uses the instance's public DNS name from the EC2 instance metadata, and the certificate also names the public and private IP addresses. nginx answers only to the names in the certificate.

The name is fixed at first boot. If you stop and start the instance without an Elastic IP and its public address changes, run sudo snipeit-set-hostname with the new name (Step 9). Better still, give the instance an Elastic IP or your own DNS name.

To check sign-in end to end from the instance itself, run this self-test. It checks the HTTPS redirect, the refused paths, the administrator password through the real sign-in form, and that a wrong password is refused:

sudo snipeit-cred-roundtrip

OK https 301 + no setup wizard/.env/sources + administrator sign-in + wrong password refused

Open the SNIPEIT_URL in your browser. The certificate is self-signed, so your browser asks you to confirm it the first time. You can also install your own certificate (Step 9). Sign in with the username admin and the password from Step 4:

A new Snipe-IT has no assets yet. The dashboard shows zero counts, one person (you), and buttons to add your first asset, licence, accessory, consumable, component or user:

Make the account yours. The administrator's e-mail address is the placeholder admin@example.com. Open the user menu (top right), choose Edit Profile, and set your name. Then set your own e-mail address on the administrator under Users, because password resets and alerts go there.

To choose your own password, use Change Password in the user menu. Then delete SNIPEIT_ADMIN_PASSWORD from /root/snipeit-credentials.txt, so the file does not hold an old password.

If you lose the administrator password, set a new one from the instance. Without an option, the command generates a random password and writes it to the credentials file. With --stdin, it reads the password you type (24 to 72 letters and digits). Either way, it clears the remember-me token and signs every session out:

sudo snipeit-set-password
sudo snipeit-set-password --stdin

Admin Settings. The gear icon (top right) opens Admin Settings. It covers branding, general settings, security (two-factor and password rules), permission groups, localisation, notifications, asset tags, labels, LDAP, SAML, backups, OAuth and API tokens:

Under General Settings, set the Email Domain and the e-mail and username formats used when you import people. Under Security, consider requiring two-factor sign-in and stronger password rules for everyone.

Add assets. Before the first asset, create the lists that it refers to. Create at least one Category, Manufacturer and Asset Model under the settings menu in the left sidebar. Snipe-IT ships the status labels Ready to Deploy, Pending and Archived, and the category Misc Software. Then choose Create New, then Asset, and fill in the asset tag, model, status and location:

Add people. Choose Users, then Create New, and enter a name and username. Tick This user can login and give a password only for people who should sign in. Add an e-mail address so they receive check-out receipts. To add many people at once, import a CSV file from Import in the left sidebar, or synchronise them from LDAP (Step 7):

Check assets, licences and accessories out to people, locations or other assets from each item's page. Snipe-IT keeps the full history and can ask the recipient to accept the item and a EULA.

Mail. Mail is off on a new instance (MAIL_MAILER=array: Snipe-IT accepts messages and discards them), so nothing is sent to the placeholder address. Snipe-IT reads its mail settings from the settings file. Edit /etc/snipe-it/snipeit.env as root and set your SMTP server. Use port 587 with STARTTLS for Amazon SES, because AWS limits outbound port 25. Then clear the cached configuration:

MAIL_MAILER=smtp MAIL_HOST=<smtp-server> MAIL_PORT=587 MAIL_USERNAME=<smtp-user> MAIL_PASSWORD=<smtp-password> MAIL_FROM_ADDR=<assets@your-domain> MAIL_FROM_NAME='Snipe-IT' MAIL_REPLYTO_ADDR=<assets@your-domain> MAIL_REPLYTO_NAME='Snipe-IT' MAIL_TLS_VERIFY_PEER=true

sudo snipeit-artisan optimize:clear

Then, under Admin Settings, then Notifications, replace admin@example.com in Send alerts to with your own address. To check delivery, first make sure your administrator has your own e-mail address (Step 5). Then sign out and use I forgot my password on the sign-in page. Email Alerts Enabled is on in upstream Snipe-IT, so alerts are sent once mail is configured:

What the server contacts. Snipe-IT connects only to the mail, LDAP, SAML and webhook services that an administrator configures. The snipeit user, which runs PHP, the scheduler and first boot, cannot reach the instance metadata service, link-local or reserved addresses, multicast, loopback services, any IPv6 address or any address inside your VPC. Snipe-IT itself also refuses webhook and sync adapter targets on internal addresses.

Servers on the internet (Amazon SES, a hosted directory) work without any change. If your LDAP or Active Directory server or SMTP relay is on a private address in your VPC, allow that host, one IPv4 address or CIDR per line, and reload the rules:

echo '<ldap-server-private-ip>' | sudo tee -a /etc/sac/snipeit-egress-allow.conf
sudo systemctl restart snipeit-egress-guard

The rules are rebuilt at every boot from your VPC's address ranges. A line that is not a valid address stops the rules from loading. PHP and the scheduler then stay stopped rather than run without the rules. Fix the line and restart snipeit-egress-guard. You can see the rules with sudo nft list chain inet sac_snipeit_egress output:

meta nfproto ipv6 counter packets N bytes N reject with icmpx admin-prohibited comment "sac-backstop-ipv6" ip daddr { 0.0.0.0/8, 168.63.129.16, 169.254.0.0/16, 192.0.0.0/24, 198.18.0.0/15, 240.0.0.0/4 } counter packets N bytes N reject with icmpx admin-prohibited comment "sac-backstop" ip daddr 224.0.0.0/4 counter packets N bytes N drop comment "sac-backstop-mcast" ip daddr @vpc4 meta l4proto tcp counter packets N bytes N reject with tcp reset comment "sac-backstop-vpc4-tcp" ip daddr @vpc4 counter packets N bytes N reject with icmpx admin-prohibited comment "sac-backstop-vpc4" oif "lo" counter packets N bytes N reject with icmpx admin-prohibited comment "sac-backstop-loopback"

LDAP and Active Directory. Under Admin Settings, then LDAP, enable the integration. Enter the server (ldaps:// for TLS), bind account, base DN and field mapping, and save the settings. Then use Test LDAP Connection, and synchronise users with LDAP Sync on the Users page. Keep certificate validation on.

The scheduler and the Snipe-IT console. snipeit-scheduler.service runs Snipe-IT's schedule:run once a minute as the snipeit user, under the metadata block. Snipe-IT's artisan command line runs as snipeit in a short-lived systemd unit with the same block:

systemctl show snipeit-scheduler -p User -p IPAddressDeny
sudo snipeit-artisan --version

IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 User=snipeit Laravel Framework 12.69.3

Snipe-IT's settings file is /etc/snipe-it/snipeit.env, owned by snipeit with mode 0600. Debug output is off, and host names come only from configuration. No proxy is trusted for client addresses, cookies are Secure, and mail is off. Internal webhook and sync targets are refused, and there is no database password. Check the settings:

sudo grep -E '^(APP_DEBUG|APP_ALLOW_INSECURE_HOSTS|APP_TRUSTED_PROXIES|SECURE_COOKIES|MAIL_MAILER|DB_SOCKET|DB_PASSWORD|WEBHOOK_ALLOW_INTERNAL_TARGETS|SYNC_ADAPTER_ALLOW_INTERNAL_TARGETS)=' /etc/snipe-it/snipeit.env

APP_DEBUG=false APP_ALLOW_INSECURE_HOSTS=false APP_TRUSTED_PROXIES= SECURE_COOKIES=true MAIL_MAILER=array DB_SOCKET=/run/mysqld/mysqld.sock DB_PASSWORD= <set-at-first-boot>=false SYNC_ADAPTER_ALLOW_INTERNAL_TARGETS=false

If you put a load balancer in front of the instance, set APP_TRUSTED_PROXIES to its addresses only, then run sudo snipeit-artisan optimize:clear. Leave Enable Login with Remote User Header under Security off unless a trusted proxy in front of the instance authenticates your users.

Gravatar images are off on a new instance. The profile page still offers a Gravatar Email Address field and shows Gravatar's empty placeholder image, which your browser loads from secure.gravatar.com. Leave the field empty if you do not want your browser to contact Gravatar.

Point a DNS record at the instance (an Elastic IP keeps the address stable), then set the name that Snipe-IT is served as. This generates a new self-signed certificate for the name, points nginx and Snipe-IT's APP_URL at it, updates the URL in /root/snipeit-credentials.txt, and keeps the name across reboots:

sudo snipeit-set-hostname <your-domain>

To use a certificate from a public or internal certificate authority instead, for example one issued by Let's Encrypt for <your-domain>, copy it over the generated pair and reload nginx. Running snipeit-set-hostname again replaces it with a self-signed certificate:

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/snipeit.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/snipeit.key
sudo nginx -t && sudo systemctl reload nginx

When your users' browsers trust the certificate, you can also set ENABLE_HSTS=true in the settings file and run sudo snipeit-artisan optimize:clear. HSTS stays off on a new instance because the first-boot certificate is self-signed.

nginx serves only the application. The setup wizard, any path under /index.php, the settings file, logs, a PHP file under the uploads, the vendored sources and the dependency lock file answer 404. The PHP information page redirects to sign-in, plain HTTP redirects to HTTPS, and a request for a name that the instance does not serve gets no answer at all:

H=$(sudo grep '^SNIPEIT_URL=' /root/snipeit-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#') for p in / /login /setup /setup/user /index.php /index.php/login /.env /storage/logs/laravel.log /uploads/x.php /vendor/autoload.php /admin/phpinfo /composer.lock; do curl -sk -o /dev/null -w "%{http_code} $p\n" --resolve "$H:443:127.0.0.1" "https://$H$p" done curl -s -o /dev/null -w 'http:// -> %{http_code}\n' --resolve "$H:80:127.0.0.1" "http://$H/" curl -sk -o /dev/null -w 'unknown host name -> %{http_code}\n' --resolve "other.example:443:127.0.0.1" "https://other.example/" || true

302 / 200 /login 404 /setup 404 /setup/user 404 /index.php 404 /index.php/login 404 /.env 404 /storage/logs/laravel.log 404 /uploads/x.php 404 /vendor/autoload.php 302 /admin/phpinfo 404 /composer.lock http:// -> 301 unknown host name -> 000

Snipe-IT's database account has no password. MariaDB accepts it only over the local socket, from processes running as snipeit, and MariaDB does not listen on the network:

sudo mysql -N -B -e "SELECT CONCAT(User, '@', Host, ' authenticates by ', JSON_VALUE(Priv, '$.plugin'), ', password set: ', IF(IFNULL(JSON_VALUE(Priv, '$.authentication_string'), '') = '', 'no', 'yes')) FROM mysql.global_priv WHERE User = 'snipeit'; SELECT CONCAT('skip_networking: ', @@skip_networking);"

snipeit@localhost authenticates by unix_socket, password set: no skip_networking: ON

The certificate was generated on this instance and names its own addresses:

H=$(sudo grep '^SNIPEIT_URL=' /root/snipeit-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.compute-1.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.compute-1.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

None of the services can reach the instance metadata service, so a webhook, LDAP server or image address pointed at the metadata service gets nothing back:

systemctl show nginx php8.3-fpm mariadb snipeit-scheduler snipeit-firstboot -p Id -p IPAddressDeny

IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 Id=nginx.service IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 Id=php8.3-fpm.service IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 Id=mariadb.service IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 Id=snipeit-scheduler.service IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 Id=snipeit-firstboot.service

sudo snipeit-artisan <command> runs Snipe-IT's console with the same block.

Everything you enter is in the MariaDB database snipeit (/var/lib/mysql). Uploaded files, backups, sessions, caches, logs and the API signing keys are under /var/lib/snipeit. The settings file with the application key is /etc/snipe-it/snipeit.env. All three are on the root volume, so the simplest backup is an EBS snapshot of that volume.

Snipe-IT also makes its own backups. Each backup is a zip file with a database dump, the uploaded files and the settings file. The scheduler makes one every week. You can also make one on demand with Admin Settings, Backups, Generate Backup, or with the command line. Backups are stored on the instance in /var/lib/snipeit/storage/app/backups, so copy them off the instance, to Amazon S3 for example:

sudo snipeit-artisan snipeit:backup
sudo ls -l /var/lib/snipeit/storage/app/backups

For a database copy of your own while Snipe-IT is running:

sudo mariadb-dump --single-transaction --routines snipeit | gzip > <backup-dir>/snipeit-$(date +%F).sql.gz
sudo tar -C / -czf <backup-dir>/snipeit-files-$(date +%F).tar.gz var/lib/snipeit/storage/app var/lib/snipeit/public/uploads etc/snipe-it

Keep /etc/snipe-it/snipeit.env with every dump: its APP_KEY encrypts the secrets that Snipe-IT stores (the LDAP bind password, for example), and a restored database cannot use them without it. Backups hold every password hash and secret, so store them as carefully as the instance.

To give uploads and the database more room, enlarge the root volume in the EC2 console (Volumes, then Modify). Ubuntu grows the file system on the next boot.

To keep Snipe-IT's data on its own EBS volume instead, attach a volume, stop Snipe-IT, and copy /var/lib/mysql and /var/lib/snipeit onto it. Mount it back over the same paths with bind mounts in /etc/fstab before you start the services again. Contact support if you would like help with the move.

The code is read-only to PHP, and the upstream upgrade script is not shipped. New Snipe-IT releases arrive as new versions of this listing, and support can help you move your data to one.

Operating system security updates install automatically. Run sudo apt-get update && sudo apt-get upgrade to apply everything else. nginx, PHP-FPM and MariaDB restart cleanly, and Snipe-IT keeps all of its data.

Component Path

Snipe-IT /var/www/snipe-it (owned by root, read only to PHP; nginx serves public/)

Settings and application key /etc/snipe-it/snipeit.env (owned by snipeit, mode 0600)

Database MariaDB database snipeit (/var/lib/mysql)

Uploads, backups, sessions, caches, logs and API keys /var/lib/snipeit

nginx site /etc/nginx/sites-available/sac-snipeit

Certificate and key /etc/nginx/ssl/snipeit.crt, /etc/nginx/ssl/snipeit.key

Scheduler snipeit-scheduler.service

Outbound allow list /etc/sac/snipeit-egress-allow.conf (snipeit-egress-guard.service)

Helpers /usr/local/sbin/snipeit-set-password, snipeit-set-hostname, snipeit-artisan, snipeit-cred-roundtrip

Credentials /root/snipeit-credentials.txt (mode 0600)

Source, changes and dependency audit /usr/share/doc/snipe-it/SOURCE.txt, composer-audit.txt

• Allow port 22 from your admin network only, and allow ports 80 and 443 only from the networks your staff work from.
• Use your own DNS name and a certificate that your users' browsers trust (Step 9).
• Set your own e-mail address on the administrator and change its password (Step 5). Turn on two-factor sign-in under Security, and give each person their own account in a permission group with only the access they need.
• Allow only the internal hosts that Snipe-IT needs in /etc/sac/snipeit-egress-allow.conf (Step 7), and keep LDAP certificate validation on.
• Copy Snipe-IT's backups off the instance, keep the operating system patched, and snapshot the root volume regularly.